Supported Targets

Overview

Nullify pentests REST and GraphQL APIs, server-side rendered HTML applications, single-page applications, and custom TCP/UDP protocols.

Application Types

Type	Supported	Notes
REST APIs	Yes	Full support with or without OpenAPI definitions.
GraphQL APIs	Yes	Introspection, mutation testing, authorization matrix analysis.
SSR HTML Apps	Yes	Server-side rendered web applications (Django, Rails, Express, etc.).
SPAs	Yes	Single-page applications (React, Vue, Angular).
SOAP APIs	Not yet	Register interest with the Nullify team.
WebSockets	Not yet	Event-driven assessments are on the roadmap.
gRPC	Not yet	Reach out if you would like to participate in design partners.
Custom TCP/UDP Protocols	Not yet	Custom protocol testing on the roadmap.